Installing, upgrading, and uninstalling Config Connector

This topic describes how to install Config Connector on your cluster.

Before you begin

Before you start, make sure you have performed the following tasks:

Set up default gcloud settings using one of the following methods:

  • Using gcloud init, if you want to be walked through setting defaults.
  • Using gcloud config, to individually set your project ID, zone, and region.

Using gcloud init

  1. Run gcloud init and follow the directions:

    gcloud init

    If you are using SSH on a remote server, use the --console-only flag to prevent the command from launching a browser:

    gcloud init --console-only
  2. Follow the instructions to authorize gcloud to use your Google Cloud account.
  3. Create a new configuration or select an existing one.
  4. Choose a Google Cloud project.
  5. Choose a default Compute Engine zone.

Using gcloud config

  • Set your default project ID:
    gcloud config set project [PROJECT_ID]
  • If you are working with zonal clusters, set your default compute zone:
    gcloud config set compute/zone [COMPUTE_ZONE]
  • If you are working with regional clusters, set your default compute region:
    gcloud config set compute/region [COMPUTE_REGION]
  • Update gcloud to the latest version:
    gcloud components update

Choosing your installation method

You can install Config Connector with either:

Select a tab below to choose your installation type.

GCP Identity

Creating a ClusterRoleBinding

Config Connector needs permission to create Kubernetes Roles before it can create resources.

Verify that you can create Roles by running the following command.

kubectl auth can-i create roles

If the output is yes, continue to Create an Identity.

If the output is no, create a ClusterRoleBinding in your cluster. This allows you to create Roles. Replace [ACCOUNT_EMAIL] with the email associated with your Google Cloud account.

kubectl create clusterrolebinding cluster-admin-binding \
--clusterrole cluster-admin \
--user [ACCOUNT_EMAIL]

The outputs should contain the phrase cluster-admin-binding created. If it does not, contact your account or cluster administrator about permissions.

Creating an identity

A Config Connector cluster needs a Google Cloud identity to communicate with other resources. To set up the identity, you create an Cloud Identity and Access Management (Cloud IAM) Service Account and Service Account Key. After that, you import the Key's credentials as a Secret in each cluster that runs Config Connector.

Creating a service account
  1. Create the cnrm-system Service Account with gcloud:

    gcloud iam service-accounts create cnrm-system
  2. Give the IAM Service Account elevated permissions on your project. Replace [PROJECT_ID] with your project ID.

    gcloud projects add-iam-policy-binding [PROJECT_ID] \
    --member serviceAccount:cnrm-system@[PROJECT_ID].iam.gserviceaccount.com \
    --role roles/owner
  3. Create a Service Account Key and export its credentials to a file named key.json. Replace [PROJECT_ID] with your project ID and run the following:

    gcloud iam service-accounts keys create --iam-account \
    cnrm-system@[PROJECT_ID].iam.gserviceaccount.com key.json

Applying credentials to your cluster

Apply the credentials to each cluster where you will run Config Connector.

  1. Create the cnrm-system namespace.

    kubectl create namespace cnrm-system
  2. Import the key's credentials as a Secret.

    kubectl create secret generic gcp-key --from-file key.json --namespace cnrm-system
  3. Remove the credentials from your system.

    rm key.json

Installing Config Connector

To manually install Config Connector, download the installation tar file and extract it, then apply the contents to your cluster.

  1. Download the latest installation bundle tar file:
gsutil cp gs://cnrm/latest/release-bundle.tar.gz release-bundle.tar.gz
  1. Extract the tar file:

    tar zxvf release-bundle.tar.gz
  2. Apply the manifests to your cluster:

    kubectl apply -f install-bundle-gcp-identity/

Workload Identity

Prerequisites

Before you install Config Connector to a cluster, perform the following steps.

  • Create or identify a GKE cluster where Config Connector has not yet been installed.
  • Set up Workload Identity on the cluster where you will install Config Connector.

Create an Identity

Setting up the identity includes:

  • Creating an Cloud IAM Service Account.
  • Creating a binding between the Cloud IAM Service Account and Config Connector's Kubernetes service account.
  1. Create the cnrm-system Service Account with gcloud:

    gcloud iam service-accounts create cnrm-system
  2. Give the IAM Service Account elevated permissions on your project. Replace [PROJECT_ID] with your project ID.

    gcloud projects add-iam-policy-binding [PROJECT_ID] \
    --member="serviceAccount:cnrm-system@[PROJECT_ID].iam.gserviceaccount.com" \
    --role="roles/owner"
    
  3. Create a Cloud IAM policy binding between the IAM Service Account and the predefined Kubernetes service account run by Config Connector. Replace [PROJECT_ID] with your project ID.

    gcloud iam service-accounts add-iam-policy-binding cnrm-system@[PROJECT_ID].iam.gserviceaccount.com \
    --member="serviceAccount:[PROJECT_ID].svc.id.goog[cnrm-system/cnrm-controller-manager]" \
    --role="roles/iam.workloadIdentityUser"

Deploying Config Connector

  1. Download the latest installation bundle tar file:

     gsutil cp gs://cnrm/latest/release-bundle.tar.gz release-bundle.tar.gz
  2. Extract the tar file.

    tar zxvf release-bundle.tar.gz
  3. Replace ${PROJECT_ID?} with your project ID in the installation manifest.

    sed -i 's/${PROJECT_ID?}/[PROJECT_ID]/' install-bundle-workload-identity/0-cnrm-system.yaml
  4. Apply the manifests to your cluster.

    kubectl apply -f install-bundle-workload-identity/

Namespaced mode

Namespaced mode is an extension of the Workload Identity installation. It allows you to authenticate to multiple Google Service Accounts using different Kubernetes Service accounts in your Config Connector cluster.

Prerequisites

Before you install Config Connector to a cluster, perform the following steps.

  • Create or identify a GKE cluster where Config Connector has not yet been installed.
  • Set up Workload Identity on the cluster where you will install Config Connector.
  1. Create the Service Account for your Namespace with gcloud:

    gcloud iam service-accounts create cnrm-system-[NAMESPACE]
  2. Give the IAM Service Account elevated permissions on your project. Replace [NAMESPACE] with your Namespace name and [PROJECT_ID] with your project ID.

    gcloud projects add-iam-policy-binding [PROJECT_ID] \
    --member="serviceAccount:cnrm-system-[NAMESPACE]@[PROJECT_ID].iam.gserviceaccount.com" \
    --role="roles/owner"
    
  3. Create a Cloud IAM policy binding between the IAM Service Account and the predefined Kubernetes service account run by Config Connector.Replace [PROJECT_ID] with your project ID and NAMESPACE with your Namespace name.

    gcloud iam service-accounts add-iam-policy-binding cnrm-system-[NAMESPACE]@[PROJECT_ID].iam.gserviceaccount.com \
    --member="serviceAccount:[PROJECT_ID].svc.id.goog[NAMESPACE/cnrm-controller-manager]" \
    --role="roles/iam.workloadIdentityUser"

Install Config Connector

  1. Download the latest installation bundle tar file:

    gsutil cp gs://cnrm/latest/release-bundle.tar.gz release-bundle.tar.gz
  2. Extract the tar file.

    tar zxvf release-bundle.tar.gz
  3. Replace ${PROJECT_ID?} with your project ID in the installation manifest.

    sed -i 's/${PROJECT_ID?}/[PROJECT_ID]/' install-bundle-namespaced/0-cnrm-system.yaml
  4. Install the common Config Connector components on your cluster.

    kubectl apply -f install-bundle-namespaced/0-cnrm-system.yaml \
     -f install-bundle-namespaced/crds.yaml

Set up your namespaces

Repeat the following steps for each Namespace where you will install Config Connector.

  1. Replace ${PROJECT_ID?} with your project ID, and ${NAMESPACE} with your Namespace in the installation bundle.

    sed -e 's/${PROJECT_ID?}/[PROJECT_ID]/' \
    -e 's/${NAMESPACE?}/[NAMESPACE]/' \
    install-bundle-namespaced/per-namespace-components.yaml > install-bundle-namespaced/per-namespace-components-[NAMESPACE].yaml
  2. Install Config Connector into your Namespace.

    kubectl apply -n [NAMESPACE] -f install-bundle-namespaced/per-namespace-components-[NAMESPACE].yaml

Verify Your Installation

Config Connector runs a single system process named cnrm-system. You can verify the pod for this process has a STATUS of Running, by executing the following command:

kubectl wait -n cnrm-system \
 --for=condition=Initialized pod \
 cnrm-controller-manager-0

If you installed Config Connector in Namespaced mode, specify your Namespace:

kubectl wait -n [NAMESPACE] \
 --for=condition=Initialized pod \
 cnrm-controller-manager-0

If Config Connector is installed correctly, the output is similar to the following:

pod/cnrm-controller-manager-0 condition met

Setting your default namespace

You can simplify commands and avoid adding `--namespace` to each `kubectl` command by changing the default context's Namespace. To do so, run the following command, replacing [NAMESPACE_NAME] with your Namespace name:
kubectl config set-context --current --namespace [NAMESPACE_NAME]

Troubleshooting

CRD instances can be created, but nothing seems to happen. There are no events.

Check the logs from the Config Connector controller:

kubectl logs cnrm-controller-manager-0 --namespace=cnrm-system

Troubleshooting Google Cloud identity installations

If the pod with name like cnrm-controller-manager-X does not have status Running, try reinstalling the Google Cloud Service Account credentials by first deleting the existing secret (kubectl --namespace=cnrm-system delete secret gcp-key) and then following the instructions to create the Secret. Then, delete the controller pod to trigger a restart:

kubectl delete pod --namespace=cnrm-system delete pod cnrm-controller-manager-0

Manually uninstall Config Connector

To manually uninstall Config Connector, delete the installation bundle from your cluster.

From the same folder containing the contents of the unpacked tar file from the manual installation, run this command to delete:

kubectl delete -f install-bundle/crds.yaml
kubectl delete -f install-bundle/0-cnrm-system.yaml

Upgrading Config Connector

To manually upgrade Config Connector:

  1. Run the manual uninstall steps
  2. Run the manual install steps

What's next

Get started with Config Connector.